enterprise risk management: why the ethics and compliance function ...

More documents

Recommendations

Info

Knight and Pretty argue that effective ERM can also help companies protect their stock price in case of scandals or other reputational problems. 3 Enterprise risk management gives senior management information and resources for managing crises quickly and efficiently. 4 This is no small point. Reputation and other "intangibles" now make up more than half of a companies stock value. 5 With the rise of globalization, the shifting domestic and international political landscapes, and the ability of the media and special-interest groups to spread information instantaneously, reputational risks abound. Understanding and managing these risks well is crucial to the success of a company, its owners, and other stakeholders. While enterprise risk management can be a powerful tool, fewer than 40% of CEOs trust their current enterprise risk management. 6 Further, a significant number of CFOs who participate in ERM believe the process needs to be improved. 7 In this white paper, we discuss how Ethics and Compliance can help increase the trustworthiness and coherence of enterprise risk management, reducing the need for outside consultants. In Part I, we discuss the scope of risk and the advantages and disadvantages of Ethics and Compliance leading or participating in enterprise risk management. In Part II, we look at several examples of how Ethics and Compliance departments and officers have participated in risk management programs, from leadership of the program to executing smaller parallel activities. In Part III, we show that this new role moves Ethics and Compliance from a cost center that prevents harm to a functional area that adds value. Our concluding message is that Ethics and Compliance is an undervalued asset. Companies that fully utilize the Ethics and Compliance function in risk assessment and management can gain a competitive advantage. 3 Rick Funston, Principal, Enterprise Risk Management Leader, Deloitte & Touche LLP. 4 Reputation & Value - the case of corporate catastrophes © Rory F Knight and Deborah J Pretty, Oxford Metrica, 2001. 5 Rick Funston, Principal, Enterprise Risk Management Leader, Deloitte & Touche LLP. 6 IBID; also see: Financial Executive Survey Shows Enterprise Risk Plagues Corporate America, Despite Confidence in Risk Preparation: "Companies are embracing the concept of enterprise risk management but continue to struggle with implementation according to the findings in the 2006 Oversight Systems Report on Risk Management. The national survey of financial executives released today also found room for improvement in the way companies assess, manage and prevent risk." http://www.oversightsystems.com/news_events/release_Risk_Plagues_Corporate_America.php retrieved June 3, 2007. Also see Protiviti U.S. Risk Barometer (survey conducted by Protiviti 2005) http://www.protiviti.com/content/PRO/pro-us/request/index.htmlid=us- retrieved June 3, 2007 pub19&doc=http%3A%2F%2fwww.protiviti.com%2Fdownloads%2FPRO%2Fprous%2FProtivitiUSRiskBarometer.pdf. 7 Internal Audit Capabilities and Needs Survey (survey conducted by Protiviti third and fourth quarters of 2006) http://www.protiviti.com/portal/site/pro-us/menuitem.21d938e1a3e99f7bd5332a10f5ffbfa0/ (accessed June 3, 2007).
PART I: ETHICS AND COMPLIANCE: A VALUABLE ADDITION TO THE ERM TEAM Prior to the corporate frauds and bankruptcies that began this century, senior managers devoted their attention to increasing the value of the company—stock price, market share, and other metrics. Protecting current assets was the job of functional areas such as Ethics and Compliance. 89 Enron and WorldCom changed this mindset, but not as much as was warranted. On the one hand, senior managers realized that if functional areas devoted to protecting corporate assets did not do their job, the entire enterprise could be lost. Fear of these spectacular losses gave Ethics and Compliance more attention from the C-suite and boards of directors. On the other hand, Ethics and Compliance was still seen as a cost center preventing loss. In this white paper, we will see that Ethics and Compliance can add significant value to an organization’s ERM process, and therefore to organizational value. There are several reasons why Ethics and Compliance is well-suited to play a role in the enterprise risk management team. First, Ethics and Compliance has extensive cross-functional experience. This experience stems from helping their organizations to implement the Federal Sentencing Guidelines for Organizations 10 . These guidelines were open-ended with no history of how to apply them. 11 ERM is also a new effort, with many open-ended guidelines and little history of application. The skills Ethics and Compliance has acquired in the more than 15 years of working with the FSGO prepare them well for adding value to ERM. Second, Ethics and Compliance has often played a role in applying the regulations that have come out of SOX, the Public Company Accounting Oversight Board, and the SEC. As a member of a cross-functional team, Ethics and Compliance is in a good position to make sure that these regulations and their nuances—as well as any business opportunities they may generate—are captured by ERM. 8 Rick Funston, Principal, Enterprise Risk Management Leader, Deloitte & Touche LLP. Also see "Improving Risk Quality to Drive Value" p. 4 ©Oxford Metrica 2003. 9 Internal audit and security are other functional areas devoted to protecting assets. 10 In this way, it is similar to internal audit. However, Ethics and Compliance has a skill set that internal audit does not. Internal audit guidelines are relatively specific, and where they are not specific there is a history of application. This is not to say that issues in internal audit are always clear. Far from it. The point we are making is one of relative clarity. 11 For example, Ethics and Compliance have to satisfy criteria enumerated in the Federal Sentencing Guidelines for Organizations, first established in 1991 and revised in 2004. The Guidelines list seven criteria for an effective Ethics and Compliance program. These criteria were written so that they could be used by organizations of different sizes and structures. The wide applicability of these criteria comes with a price. Organizations need to figure out how to satisfy these criteria in their particular circumstances. In short, there was no cookie-cutter, one size fits all framework that Ethics and Compliance officers could simply install in their organizations. Nor could they rely on past practices.
Page 1 and 2: Enterprise Risk Management: Why the
Page 3 and 4: TABLE OF CONTENTS Executive Summary
Page 5: experience with fraud or as a react
Page 9 and 10: PART II: CASES A. Large Perishable
Page 11 and 12: A recent development in the company
Page 13 and 14: Key Learnings: • While ERM began
Page 15 and 16: controls appropriate to the area us
Page 17 and 18: which generate a variety of risks r
Page 19 and 20: What surprised ILHS was the difficu
Page 21 and 22: • Ethics and Compliance can take
Page 23: We discussed nine cases where Ethic

enterprise risk management: why the ethics and compliance function ...

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?